netdev - Re: [caif_serial] Question: ldisc_close() drops tty ref but keeps ser->tty published

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6D59E412-D61D-461D-8025-38BBB3BD3F15@psu.edu>
Date: Mon, 19 Jan 2026 18:43:39 +0000
From: "Bai, Shuangpeng" <SJB7183@....EDU>
To: "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [caif_serial] Question: ldisc_close() drops tty ref but keeps
 ser->tty published

Hi kernel maintainers,

We report a UAF bug on tty object caused by this imbalance. 

https://groups.google.com/g/syzkaller/c/usNe0oKtoXw/m/Ogt5bJ-RAQAJ

In short, after tty is freed, there is another path that can access ser->tty and trigger a UAF bug. 
The UAF bug report contains more details, like stacktraces and reproducers about the bug.

Best,
Shuangpeng






> On Jan 11, 2026, at 18:00, Bai, Shuangpeng <baisp@....edu> wrote:
> 
> Hi netdev/TTY maintainers,
> 
> I am looking at drivers/net/caif/caif_serial.c: ldisc_close():
> 
> static void ldisc_close(struct tty_struct *tty)
> {
>    struct ser_device *ser = tty->disc_data;
>    tty_kref_put(ser->tty);
> 
>    spin_lock(&ser_lock);
>    list_move(&ser->node, &ser_release_list);
>    spin_unlock(&ser_lock);
>    schedule_work(&ser_release_work);
> }
> 
> In ldisc_open(), ser->tty is set by taking a reference:
> 
>    ser->tty = tty_kref_get(tty);
> 
> In ldisc_close(), tty_kref_put(ser->tty) drops the tty reference while
> ser->tty remains published. This can create a window where other CPUs may
> still observe a non-NULL ser->tty pointer after the reference has been
> dropped, which could be unsafe under concurrency if any reader
> dereferences ser->tty without first taking its own reference.
> 
> In addition, the ser object itself is released asynchronously via
> ser_release_work, so the struct (and thus ser->tty) can remain accessible
> for a relatively long time after ldisc_close(). This extends the lifetime
> of the published stale pointer and widens the potential race window.
> Would it make sense to clear/unpublish ser->tty in ldisc_close(), so that
> other CPUs will not observe a non-NULL ser->tty after the reference has
> been dropped?
> 
> Thanks,
> Shuangpeng Bai